CVE-2026-105110

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

Affected

Iskratel · Innbox

CVSS v4.0 CNA

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.79% chance of exploitation in the next 30 days, 86th percentile

Published

2026-10-08

Proof-of-concept exploits (1)

• BlackHatExploitation/innbox_root0★ · 2026-10-09

References

• CVE Record
• NVD entry

Related

• CVE-2026-12183
• CVE-2026-18963
• CVE-2026-3843
• CVE-2026-67276
• CVE-2026-72898
• CVE-2026-85097